This is a problem report in the hopes that Microsoft will stop thinking that no one is bothered by KB973917-v2. We had to uninstall that update (control panel, add/remove, [x] show updates, sort by date, uninstall from 10-Mar-2010) in order to make ALL web sites served by IIS 6 stop giving the SERVICE UNAVAILABLE error message in all browsers. This is the second time this has happened. The first time was December 23, 2009. Many people posted complaints at that time. I do not see other complaints about this March version 2 of the same thing, yet, so I wanted to get the ball rolling. I also notice that this forum does not even have a section for Win2003 .... sad. Further important details, trying to keep the sarcasm to a minimum... There is no windows\system32\drivers\etc\HOSTS file on the system. There is only one application pool in IIS, DefaultAppPool, and it is running under Local System. Event Viewer, application log, contains this : "The worker process failed to initialize the http.sys communication or the w3svc communication layer and therefore could not be started. The data field contains the error number. The Event ID for that log entry is 2269; source W3SVC-WP. Running WinVer shows that Service Pack 2 has been installed, and we tried reinstalled SP2 again today and that made no difference whatsoever. Apparently reinstalling SP2 helped some people in December 2009. This is on a server which has been otherwise completely stable for many years, and it was extremely disappointing to have so much downtime caused by a Windows security update. SUGGESTION: Microsoft should have a feedback mechanism which lets people report when individual updates cause trouble for them, something linked directly from the security bulletin page ( in this case, http://www.microsoft.com/technet/security/bulletin/MS09-071.mspx ) That page does link to this forum and that is why I am posting here, now.

HiI had a problem with te same KB this morning although not related to IIS/websites (windows 2003 R2 64 bits hosting Exchange 2007 SP1 and thus IIS)You can find the details here: http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/292c1099-a2b0-459d-af0a-8c20f445c155In a nutshell, I had to re-register a IPsec dll:regsvr32 polstore.dllHope this helps,Steve

Thank you for the reply, Steve. I do not think my situation is the same, because tcp/ip in general was working. I could ping the machine, and get remote access. The only thing failing was IIS application pools. Do you know whether it could hurt to try re-registering the polstore.dll, before and/or after trying to reinstall the problematic patch? Also I wanted to tell you that, in February, at the time of reboot after applying OS patches, I had 3 servers completely lock up - as you describe - with all ip traffic blocked completely. I had to power cycle all of them, and then they came back to life. On 2 of 3 machines, I had uninstalled Computer Associates Anti-Virus software (2007 edition) and I suspected that its uninstall was somehow beyond the power of polstore.dll to comprehend and so it just locked out everything. But who knows. Again, slightly different, in that those servers all came back to life after the power cycle. Cheers, Ann

Here are the details which imply that IPSEC Policy service has something to do with it, so maybe re-registering polstore.dll is on the right track. Event Viewer, SYSTEM log, lists the following errors when KB973917-v2 is installed, and has no such errors when that patch is uninstalled: The Workstation service depends on the IPSEC Policy service which failed to start because of the following error: The system cannot find the file specified. Event ID = 7001 Source = Service Control Manager This error cascades to the next: The Computer Browser service depends on the Workstation service which failed to start because of the following error: The dependency service or group failed to start. ... then to : The Java Virtual Machine service failed to start due to the following error: The system cannot find the path specified. ... then to: The Server service depends on the IPSEC Policy service which failed to start because of the following error: The system cannot find the file specified. ... then to : The Remote Connection service failed to start due to the following error: The system cannot find the file specified. -Ann

This isn't a SBS box by any chance is it?http://blogs.technet.com/sbs/archive/2008/07/17/some-services-may-fail-to-start-or-may-not-work-properly-after-installing-ms08-037-951746-and-951748.aspxWould you mind installing it a second time (I know that's asking a lot) to see if it repros a second time?

No, it is not a small business server; it is not running Exchange nor any other smtp server. When this first happened in December and we thought it was malware (since we had never had an OS patch kill the server before), we restored from backup and repeated the installations in various ways at least 5 times. The SERVICE UNAVAILABLE outcome is 100% repeatable, and in case it's not obvious, to see that message in a web browser, the tcp/ip layer has to be working because the response is getting from the server out to the browser on the public internet. So it's not a full "go into block" mode issue. It is something else, closer to this diagnosis http://blogs.msdn.com/friis/archive/2009/12/16/aftermath-of-the-release-of-kb-973917-for-iis.aspx BUT we did not, and do not, have a binary mismatch as defined in that blog posting. (And reinstalling SP2 did not solve it.) Ann

Thanks, you've saved my life today ;-)